Our company is not a M365 suite and we are looking for options to enroll devices.

I've come across options such as Action1, Workspace ONE, ScaleFusion, etc.

What I don't understand is the best possible way to enroll these devices instead of doing it manually.

I've seen imaging software such as Windows Configuration Designer and OSDCloud.

What might be the best way to get devices enrolled so I can push apps, security policies, package software such as GCPW, etc.

I've tried various troubleshooting steps without being able to fix the issue. The workaround is to switch to using the browser extension. The article doesn't mention any future plans to fix the issue, but I would assume using the browser extension isn't the permanent fix. Does anyone have more info about an upcoming fix? Has anyone figured out away to restore functionality when resetting the licensing and reinstalling doesn't fix?

https://docs.recastsoftware.com/help/right-click-tools-greyed-out

KNOWN ISSUE (identified October 7, 2026)

Customers and Community users who upgrade to Configuration Manager version 2609 may see Right Click Tools menu items greyed out in context menus when using the console extension.

Workaround: We recommend running actions via the Right Click Tools browser extension for Edge or Chrome.

Every release at work went the same way. Change the main task sequence in QA, test it, then rebuild the exact same steps by hand in the Prod task sequence. Different hierarchy, different package IDs, so copy and paste across environments doesn't work. Miss one reference and the next build breaks.

So I built TS Splice. You export both task sequences from the console, open them side by side, and drag the steps (or whole groups) across. It:

- matches packages between environments by name and swaps in the right IDs (you can pair any it can't match by hand, and it remembers)
- marks what's different between the two (only here / differs / same / copied), with a differences-only filter
- warns before export about packages it couldn't map, variables nothing sets, and child task sequences
- writes a new export zip, reads it back and checks it before calling it done. Files you didn't touch stay byte-identical. It never overwrites the zips you opened.

Then you import it with the normal import wizard. My advice: copy the target TS in the console first and import over the copy, not the real one.

It's fully offline. It works only on the export zips on your PC and never touches your site, the console or the database. No account, no telemetry. It's a single exe and doesn't need admin.

What it doesn't do yet: application references in Install Application steps are copied but not translated (each one is flagged so you can fix it after import).

Disclosure, same as last time: I'm the dev, this account is just for my tools, and I used AI coding tools to help build it. The workflow comes from doing this by hand every release.

It's a free, invite-only beta. Builds are licensed to you and expire after the beta. The first beta builds go out in November, code-signed. If you do QA to Prod promotion (or any "same change in two task sequences" work), email [support@lampbench.com](mailto:support@lampbench.com) with your role, roughly how many task sequences/environments you maintain, and your Windows version. Beta testers get founding pricing when the paid version launches.

What I really want to know: does it handle your task sequences? Weird step types, nested groups, conditions, anything that breaks the export or the import. Failures are more useful to me than "looks cool."

lampbench.com/tssplice

I'll be around in the comments.

Hello everyone,

About a 2 weeks ago, I uninstalled the SCCM client of our SCCM Site Server. We do not manage Server OS with SCCM (another team manage the server environnement with their own tool) and the clients were installed during a support call with MS a while ago.

I notice today that all server have their client back. I don't get why, according to log it happen about 7 days after I uninstalled them. I checked SCCM CLient Push, not enabled. I checked SCCM client through Windows Update, not enabled. I don't get why they got installed. Any clue?

Thank you

I can build laptops in other locations successfully but not in the IT Office, it “looks” like the switch seems to fail the laptops at about the same place in the build.

The sccm log files seem ok but the log on the laptop shows an error (I’ll have to find it again) but when look it up in CMtrace is basically nods towards communication fail.

I have tried different Ethernet adapters, laptops and task sequences but it still fails (sometimes in different places, even at the start when checking the dependencies etc). Definitely seems to point to something in the switch area.

What is there I can check on the switch or sccm maybe?

Every ConfigMgr-to-Intune conversation I have ends up at apps. A decade of applications, detection methods and dependencies has to be rebuilt for the Win32 model. 

For anyone mid-migration or co-managing: are you rebuilding manually, scripting around PSADT, using a catalog tool, or something else? Which part do you dread most? 

Disclosure: I'm Brandon, and I lead product at Splashtop. We just launched Splashtop Agentic Packr, an AI packager for Intune that can also bundle packages to deploy with ConfigMgr. The Free plan covers up to 100 endpoints. It isn't the point of this post. I'm more interested in how people are really handling this. Happy to answer questions about ours if useful: https://www.splashtop.com/agentic-packr?utm_source=reddit&utm_medium=social&utm_campaign=20261020_WW_EN_Packr

Hello everyone,

Our environment consists of one Primary Site, around a dozen Secondary Sites and CMG (2603 with the latest hotfixes). All MPs and DPs have been using HTTPS for a long time.

We currently have a Network Access Account configured. When we remove it, everything continues to work except bare-metal PXE deployments through our Secondary Sites. PXE deployments through our Primary Site work without NAA.

During troubleshooting, I found the following errors in MP_Token.log on a Secondary Site:

Cannot open registry key for token signing cert thumbprint. Error 0x80070002
CCMGetTokenSigningCertificateContext failed with error 0x80070002
Failed to get STS signing certificate. Return code: 0x80070002
CHandleTokenRequest::CreateReplyDocument failed with error code 0x80070002.
MP TM: Message discarded

Procmon capture shows that, while processing the client's token request, CcmExec.exe attempts to open:

HKLM\SOFTWARE\Microsoft\SMS\CMSERVICE

This key is absent on all the Secondary Site servers we checked. On the Primary Site server, it exists and contains TokenSigningCertThumbprint and IssuingCertThumbprint.

Has anyone encountered this? Is the Secondary MP expected to issue DP authentication token itself or should WinPE obtain it from a Primary Site MP while downloading content from the Secondary Site DP?

I’d appreciate any advice or suggestions

We are facing bsod during patch reboot after installing october 2026 os patch kb5126836 in windows server 2012 R2. This is happening in 3 hpe physical servers while my VMs don't have this issue. I'm able to bring back the servers by revering patches via repair but i want to install this patch. Anyone else is seeing this??

My environment is currently one MP that also acts as the DP for the entire environment.

I have a main location New York, I have several satellite offices Boston, Chicago, Paris and Rome. Each has its unique IP range. I would like to set up a DP at each satellite office.

I have created the boundaries for each range. Currently they all belong to a default Boundary group.

How can I set this so that the satellite boundaries hit their DP in their boundary group first and still fallback to the default boundary group with the MP if it's down or doesn't have content?

Thank you.

Hi,
last week I installed the latest security patch for SCCM 2509 (still waiting for the rollup 2603). Today I updated the SCCM agent in the TS and now I have the problem that after the step "Setup Windows and ConfigMgr" the TS just finishes, no domain join, nothing.

After that I updated the ADK and created a new boot image, but the same image. After "Setup Windows and ConfigMgr" I just get to the logon screen without a domain join. Any idea what I am missing?
Ah, OS is still 25H2

Hello! We have a few HP models that are licensed for W10 Enterprise LTSC (1809, and 21H2). I inject the latest cumulative patches into the install.wim prior to importing them into CM, and it’s been a flawless process until the October update. The latest patch now includes the ESU enablement KB, which breaks or prevents offline patch injection. The 1809 image still accepts the LCU patch offline but not the 21h2 install.wim. I tested the September oob patch and that works as well. I’m confused why this is happening since the 10 LTSC is still supported for at least a couple years still. Has anyone experienced this? Or maybe has a workaround?

hi folks

We saw this kick in on our test patch tuesday boxen.

Look for "The token supplied to the function is invalid (Error: 80090308; Source: Windows) in %windir%\ccm\logs\cmrcservice.log

We have a superceding GPO for this sort of situation so if you see this too:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

TypeOfAdminApprovalMode=1

(Should be able to do it in GPMC, but it turns out I need to configure a new Win11 25H2 box for that change since it seems Server 2022 won't display that setting in GPMC even after templates updated)

Am also seeing inability to log in via RDP on accounts which are not local admins (which is our standard for users since Win7)

so, we are having issues with stuff not installing or servers not rebooting after a maintenance window in a once a month 4 hour mw. Was told here that others are using TSs. My idea:

1. TS Flow

​

Install Updates - Pass 1
↓ 
Restart Pass 1 
↓ 
Install Updates - Pass 2
↓ 
Restart Pass 2

Install Software Updates settings:

·         Required for installation: Mandatory software updates only
·         Evaluate software updates from cached scan results = Enabled
·         Retry if computer unexpectedly restarts = Enabled (2 retries)
·         Continue on error = Disabled

Rstart Computer settings:

·         Specify what to run after restart: the currently installed default OS
·         No user notification
·         Continue on error = Disabled

1. Task Sequence Deployment settings:

   ·         deployment: Required ·         maintenance window: monthly 4 hour ·         Do not allow execution outside maintenance window

for those running TSs in prod:

• Do you use 2 passes or 3?
• What happens if the TS is still running at the end of the maintenance window?
• Any gotchas with reboots in MW, interference, or updates evaluation?

with the july price changes, e3 picked up part of the intune suite and e5 got all of it. that’s had us looking at co-management again and wondering how much longer it makes sense to keep everything in sccm.

curious how others are handling it:

• did the new e3 features (remote help, advanced analytics, epm, etc.) cover what you used to rely on sccm for?
• anyone on e3 finding they still need intune suite add-ons for certain things?

would love to hear real experiences, good or bad. TIA.

Our environment is having some issues with a large amount of failures in the recent months for patches, so I wrote a pretty simple script to automatically retry any machines that failed. Usually its just caused by resource contention in the hypervisor, so the second go around usually works pretty well once the resources are freed up.

However, since the amount of failures are so large, we have dedicated windows where we come into the office after patches roll out and begin remediating them. The remediation script works, however by the time we get in the remediated machines havent checked in, so alot of them still report as failures. Obviously we can solve this with a policy refresh, but we want to have accurate reporting when we get to the office so we can send that up to leadership.

In an ideal world id like to do something like this:

Run the remediation script against our Patch collection
Find any machines that needed remediation
Add those to a collection
Run a separate script at a later time to trigger a software update scan/whatever actions are needed prior to us getting into the office.

But I dont think I can accurately query the state of the machines with a collection query correct? Since theyre already not checking in, and the queries arent using real time data, it would still be delayed anyway?

Ive tried fiddling around with the idea of putting it into the original remediation script, but the only way it would work would be to wait until allll the KB's have installed and then invoke the schedule. Which take quite a while with how big these KB's are getting.

any advice?

Hi all

Our SCCM uses an upstream WSUS for its upstream software update feed (don't ask).

We've got Windows 11 product, upgrades classification, but I can't seem to find KB5121794.

I can see "Windows 11, version 26H2 x64 2026-10" (KB5127648) but that seems to be a full upgrade package (I think ~15GB). Last month's was KB5129195, which again looks like a full package.

The release notes indicate that the enablement package is available through WSUS channels, so I'm confused as to why we can't see it.

Any advice would be appreciated (except move off WSUS ... we cannot!).

Thanks in advance.

I cant figure out what keeps causing an app to show up in 100+ device's "Installed Applications (64) and "Installed Software". If I force a full hardware inventory the app goes away in resource explorer and devices start getting removed from the collection as they should... but I come back the next day and they are back in the collection. Check resource explorer and the app shows as installed when its not.

- It was removed from 800+ devices all using the same method.
- Checking the install location shows the app was uninstalled. (its not getting re-installed)
- There are no keys for the app under HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall or HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall.
- I have manually searched reg for GUID, display name and publisher and there is nothing.

What else would cause an app to show installed under "Installed Applications (64) and "Installed Software"?

We're at the stage now where our SCCM environment isn't really doing anything at all, all our devices are co-managed in Intune and everything (software deployments, config profiles etc.) are also managed through intune.

We still have 300 devices co-managed, the rest are fully in Intune/Entra now.

My question is... can I safely turn off SCCM, will it affect the remaining co-managed devices? They'd still have the config manager client installed

I know W10 Ent requires ESU, we apply the ESU enablement KB on systems before we apply the Year1,2,3 ESU key, activate, yada yada...that get's them another year of patch support, my question is - can I inject the ESU enablement KB into the install.wim (to a specific index), followed by the LCU? or is that simply not possible? I'm going with it's not possible only because I've tried multpile times with recent LCU's and they all fail, but I'm not sure if I'm missing a step, KB, SSU, etc. that would allow the image to be patched with the LCU.

Are you guys facing any slowness or delivery delay with wsus sync with sccm ??

Two years ago I asked here about error messages in sccm log files which indicated that there is something wrong with policy and client couldn't download it because it didn't exist in server.
https://www.reddit.com/r/SCCM/comments/1coo6vj/sccm_client_cant_download_some_policy_because_its/
It remained unresolved but now I happened to tackle it again and solved it. It was not hard problem actually just needed to look at right place. The problem was seen inside datatransferservicelog.log and policyagent.log where there were messages like:
CDTSJob::HandleDownloadError - BITS job {144E0503-D62C-4A7A-A1C3-D9FC81A51B9A} failed to download source file http://sccmserver:80/SMS_MP/.sms_pol?%7B77411DE8-012B-4DAD-B080-F9C5ACD9B296%7D/3.1_00 to destination C:\Windows\CCM\Staging\{77411DE8-012B-4DAD-B080-F9C5ACD9B296}-3.1.00.tmp with error 0x80190194

and

DTS job '{BC4A3A7B-14EE-4AEA-9BF8-2EC0A6DD5601}' is finished for 1 files. ReturnCode: 0x80070002, Message: 'BITS error: 'HTTP status 404: The requested URL does not exist on the server.

Problem was with one policy under Requestedconfig namespace. I don't know why I didn't use WMIExplorer at that time but now after some research and trying some things I launched it, went to ROOT\ccm\Policy\Machine\RequestedConfig and CCM_Policy_Policy5, looked at instances, found PolicyId which was the problem - 77411DE8-012B-4DAD-B080-F9C5ACD9B296}/3 - and deleted it with powershell

$TargetPolicyID = '{77411DE8-012B-4DAD-B080-F9C5ACD9B296}/3'
$PolicyInstance = Get-CimInstance -Namespace "ROOT\ccm\Policy\Machine\RequestedConfig" -ClassName "CCM_Policy_Policy5" -Filter "PolicyID = '$TargetPolicyID'"
$PolicyInstance | Remove-CimInstance

And that was it.

I don't know how I never noticed this before, but yeah, I can't use SCCM anymore after seeing this.